fix(bootstrap): resolve all versions in multiple-versions mode and prevent duplicate edges

Address architect and engineer feedback on multiple-versions implementation:

1. **Process all versions in resolve_and_add_top_level()**
   - Pass return_all_versions=self.multiple_versions to resolve_versions()
   - Loop through all resolved versions and add each to the graph
   - Previously only processed results[0], losing other versions
   - Maintain backward compatibility by returning first version

2. **Prevent duplicate TOP_LEVEL edges in graph**
   - Skip _add_to_graph() call for TOP_LEVEL in _bootstrap_single_version()
   - TOP_LEVEL nodes are already added in resolve_and_add_top_level()
   - Calling _add_to_graph() again would create duplicate edges

3. **Handle empty resolution results**
   - Check if resolved_versions is empty after resolution
   - Raise RuntimeError to prevent silently skipping dependencies
   - Existing exception handler routes to test_mode or fail-fast

4. **Fix test: move import to top of file**
   - Move canonicalize_name import from local to top-level
   - Change test to use RequirementType.INSTALL instead of TOP_LEVEL
   - TOP_LEVEL graph addition now happens in resolve_and_add_top_level()

All 447 unit tests pass. All 20 bootstrap/build e2e tests pass.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Rohan Devasthale <rdevasth@redhat.com>

Author: rd4398

src/fromager/bootstrapper.py

@@ -141,6 +141,10 @@ def resolve_and_add_top_level(
         This is the pre-resolution phase before recursive bootstrapping begins.
         In test mode, catches resolution errors and records them as failures.
 
+        When multiple_versions is enabled, resolves and adds all matching versions
+        to the graph, but still returns only the first (highest) version for
+        backward compatibility.
+
         Args:
             req: The top-level requirement to resolve.
 
@@ -156,20 +160,27 @@ def resolve_and_add_top_level(
             results = self.resolve_versions(
                 req=req,
                 req_type=RequirementType.TOP_LEVEL,
+                return_all_versions=self.multiple_versions,
             )
-            source_url, version = results[0]
-            logger.info("%s resolves to %s", req, version)
-            self.ctx.dependency_graph.add_dependency(
-                parent_name=None,
-                parent_version=None,
-                req_type=RequirementType.TOP_LEVEL,
-                req=req,
-                req_version=version,
-                download_url=source_url,
-                pre_built=pbi.pre_built,
-                constraint=self.ctx.constraints.get_constraint(req.name),
-            )
-            return (source_url, version)
+            if len(results) > 1:
+                logger.info(f"resolved {len(results)} version(s) for {req}")
+
+            # Add all resolved versions to the graph
+            for source_url, version in results:
+                logger.info("%s resolves to %s", req, version)
+                self.ctx.dependency_graph.add_dependency(
+                    parent_name=None,
+                    parent_version=None,
+                    req_type=RequirementType.TOP_LEVEL,
+                    req=req,
+                    req_version=version,
+                    download_url=source_url,
+                    pre_built=pbi.pre_built,
+                    constraint=self.ctx.constraints.get_constraint(req.name),
+                )
+
+            # Return first result for backward compatibility
+            return results[0]
         except Exception as err:
             if not self.test_mode:
                 raise
@@ -286,6 +297,10 @@ def bootstrap(self, req: Requirement, req_type: RequirementType) -> None:
             self._record_test_mode_failure(req, None, err, "resolution")
             return
 
+        # Check if resolution returned no versions
+        if not resolved_versions:
+            raise RuntimeError(f"Could not resolve any versions for {req}")
+
         # Bootstrap each resolved version
         for source_url, resolved_version in resolved_versions:
             self._bootstrap_single_version(req, req_type, source_url, resolved_version)
@@ -322,7 +337,9 @@ def _bootstrap_single_version(
             parent = (parent_req, parent_version)
 
         # Update dependency graph unconditionally (before seen check to capture all edges)
-        self._add_to_graph(req, req_type, resolved_version, source_url, parent)
+        # Skip for TOP_LEVEL as they were already added in resolve_and_add_top_level()
+        if req_type != RequirementType.TOP_LEVEL:
+            self._add_to_graph(req, req_type, resolved_version, source_url, parent)
 
         # Build sdist-only (no wheel) if flag is set, unless this is a build
         # requirement which always needs a full wheel.

tests/test_bootstrapper.py

@@ -3,6 +3,7 @@
 from unittest.mock import Mock, patch
 
 from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
 from packaging.version import Version
 
 from fromager import bootstrapper, requirements_file
@@ -297,9 +298,6 @@ def test_build_from_source_returns_dataclass(tmp_context: WorkContext) -> None:
 
 def test_multiple_versions_continues_on_error(tmp_context: WorkContext) -> None:
     """Test that multiple versions mode continues when one version fails."""
-
-    from packaging.utils import canonicalize_name
-
     # Enable multiple versions mode
     bt = bootstrapper.Bootstrapper(tmp_context, multiple_versions=True)
 
@@ -336,10 +334,11 @@ def mock_bootstrap_impl(
                 with patch("fromager.bootstrapper.logger") as mock_logger:
                     req = Requirement("testpkg>=1.0")
 
-                    # Call bootstrap
+                    # Call bootstrap with INSTALL type (not TOP_LEVEL, since TOP_LEVEL
+                    # nodes are added in resolve_and_add_top_level())
                     bt.bootstrap(
                         req=req,
-                        req_type=RequirementType.TOP_LEVEL,
+                        req_type=RequirementType.INSTALL,
                     )
 
                     # Verify _bootstrap_impl was called 3 times (all versions attempted)